New Illinois law bars employer access to social media accounts

Due to the immense popularity of social media web services such as Facebook and Twitter, some employers have recently begun to require employees and applicants to provide their passwords or otherwise allow access to their social media accounts. The Illinois Legislature has now put a stop to that practice.

On Aug. 1, Illinois amended the Right to Privacy in the Workplace Act to prohibit employers from de­­manding access to employees’ and job applicants’ social media accounts. The law goes into effect Jan. 1, 2013.

H.B. 3782 will prohibit employers from requesting or requiring an employee or applicant to provide any password or other related private account information in order to gain access in any manner. In addition, employers are not permitted access to social media accounts under any circumstances, including work-related investigations of misconduct or har­­assment or for other legitimate business reasons. The law contains no exceptions.

Note: The law does not prohibit employers from obtaining information about employees and applicants that is in the public domain. It also does not ban workplace policies governing the use of employers’ electronic equipment, nor does it prohibit employers from monitoring how employees use the employers’ electronic equipment and email.

Penalties for violating law

An employee or applicant may file a complaint alleging employer violations with the Illinois Department of Labor (IDOL). After investigating the complaint, IDOL may file an action in court to enforce the provisions of the act. Employees or applicants may also file a private action in court to enforce the act.

The law provides for actual damages, costs and attorneys’ fees.

Employers are prohibited from retaliating or discriminating against employees or applicants for making a complaint or instituting a proceeding under the act.

In passing this law, Illinois became the second state (after Maryland) to prohibit employers from demanding access to social media accounts. The law reflects current nationwide trends on this issue. Similar legislation has been introduced in other states including California, Delaware, Massachusetts, Michigan, Minnesota, Missouri, New Jersey, New York, Ohio, Pennsylvania, South Carolina and Washington.

In addition to these state laws, two federal laws have been introduced:

• The Social Networking Online Pro­­tection Act would prohibit em­­ployers from requiring or re­­quest­­ing an employee or applicant to provide a password or other means for accessing a private email account or personal account on a social networking site.
• The Password Protection Act of 2012 would prohibit employers from compelling or coercing any person to provide a password or similar information to access a protected computer that is not owned by the employer.

What it means for employers

So what are employers to do with this constantly changing legal landscape? First, immediately stop any practice that demands access to employees’ and applicants’ social media accounts.

Now is the time to take steps to ensure you are compliant with the law when it goes into effect. Review your policies, employment applications and any other applicable documents to ensure they do not violate the new law. If necessary, revise your documents to clarify that employer access to social media accounts is strictly prohibited.

Second, make sure that supervisors, managers and HR staff are aware of the new law and how to comply with it. Provide training so they understand the restrictions on accessing social media accounts while conducting interviews or other hiring procedures, performing investigations and taking disciplinary action.

If you have employees in several states, stay informed about the status of social media access laws that may apply outside Illinois. In addition, understand the variations and nuances in different state laws that exist today or may be passed in the future. That way, your policies and practices can be tailored to satisfy the relevant legal requirements.

Best practices

Regardless of whether a state has a law prohibiting employer access to social media accounts, you are advised not to try to access such information.

Generally speaking, you may still legally access “public” information that appears in a social media profile. However, risks remain in doing so. Obtaining personal information about an individual from a social media profile could open you up to liability for privacy, discrimination or retaliation claims.

A good rule of thumb is to only seek information from applicants and employees that is specific to the particular job and the individual’s ability to perform the job. Personal information included in a social media profile generally is not job-related. It’s best to collect applicant information through other methods such as interviews, tests and background and reference checks.